Security Bulletin: Multiple JRE vulnerabilities addressed in IBM Sterling External Authentication Server (CVE-2013-1571, CVE-2013-1500, CVE-2013-0443, CVE-2013-0440, CVE-2013-0169)

Abstract The IBM JRE embedded in the IBM Sterling External Authentication Server has security vulnerabilities in its Javadoc, and in SSL connections to the configuration GUI. Content VULNERABILITY DETAILS CVE ID: CVE-2013-1571 DESCRIPTION: The Javadoc documentation generated for the Sterling...

Security Bulletin: The embedded help system in IBM InfoSphere Streams contains a potential vulnerability (CVE-2013-0599)

Abstract The embedded help system in IBM InfoSphere Streams has a potential vulnerability where sensitive information about the help system’s implementation is disclosed. Content VULNERABILITY DETAILS: CVE ID:CVE-2013-059 9 CVSS: CVSS Base Score: 5.0 CVSS Temporal Score: See...

Exploit for Out-of-bounds Write in Openssl

CVE-2022-2274 A POC OF CVE-2022-2274 openssl The OpenSSL 3...

PT-2022-16011 · U-Boot +4 · U-Boot +4

Name of the Vulnerable Software and Affected Versions: UBoot affected versions not specified Description: The issue is related to an unchecked length field in UBoot's DFU implementation. Specifically, the U-Boot DFU implementation does not bound the length field in USB DFU download setup packets,...

fhir-works-on-aws-authz-smart 信息泄露漏洞

fhir-works-on-aws-authz-smart is a SMART implementation on FHIR v1.0.0 of the FHIR Works on AWS framework open-sourced by Amazon Web Services Labs. Designed to leverage the OAuth2/OIDC authorization server to authorize requests. An information disclosure vulnerability exists in...

Ubuntu: Security Advisory (USN-5630-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5630-1: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-33655 Moshe Ko...

Why Zero Trust Should be the Foundation of Your Cybersecurity Ecosystem

For cybersecurity professionals, it is a huge challenge to separate the "good guys" from the "villains". In the past, most cyberattacks could simply be traced to external cybercriminals, cyberterrorists, or rogue nation-states. But not anymore. Threats from within organizations – also known as...

Azure Identity SDK と Azure Key Vault SDKに関する多層防御のためのアップデートとベストプラクティスの実装ガイダンス

本ブログは、Defense-in-Depth Updates for Azure Identity SDK and Azure Key Vault SDK plus Best Practice Implementation Guidance の抄訳版です。最新の情報は...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2023-10603)

Google TensorFlow is an end-to-end open source platform for machine learning from Google. Google TensorFlow has an input validation error vulnerability that stems from the fact that the BlockLSTMGradV2 implementation does not fully validate its input, which could be exploited by an attacker to...

SUSE-SU-2022:3294-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP2 kernel was updated receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries bnc1203107. -...

USN-5616-1: Linux kernel (Intel IoTG) vulnerabilities

Asaf Modelevsky discovered that the IntelR 10GbE PCI Express ixgbe Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. CVE-2021-33061 Moshe Kol, Amit Klein and Yossi Gilad discovered that the I...

The vulnerability of the TCP/IP protocol implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the TCP/IP protocol implementation in Windows operating systems is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2022-2300)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...

Pros and Cons of 5G

As private 5G networks continue to roll-out, CISOs and security leaders need to fully aware of the security implications to minimize cyber risk. Explore pros and cons as well as security tips for implementing private 5G...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2022:10119-1 Rating: important References: 1202403 1202964 1203102 Cross-References: CVE-2022-3038 CVE-2022-3039 CVE-2022-3040 CVE-2022-3041 CVE-2022-3042 CVE-2022-3043 CVE-2022-3044 CVE-2022-3045 CVE-2022-3046...

Security Bulletin: IBM HTTP Server CPU utilization (CVE-2014-0963)

Summary IBM HTTP Server is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: IBM HTTP Server is affected by a problem with the handling of certain S...

LP token price calculation suceptible to oracle attack manipulation

Lines of code Vulnerability details Impact The current calculation of the LP token its no accurate. Currently you formula is a the sum of the underlying asset value; sumPiRi / supply Sumatory of each token prices times reserve, divided by total supply, but this is suceptible to oracle manipulatio...

CVE-2022-36058 elrond-go MultiESDTNFTTransfer call on a SC address with missing function name

Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks historical or actual could encounter a MultiESDTNFTTransfer transaction like this: MultiESDTNFTTransfer with a missing function name. Basic functionality li...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-088 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause...